Exports

An export is one zip with everything a plan found, made so that a reader can check it without asking Yore anything. Make one on a plan's Export tab with Make an export. It's built in the background and listed there with its size and the SHA-256 of its manifest. A plan needs at least one fetched page.

What it holds

• manifest.json: every ticked page, every capture the archive holds of it in the plan's window, every version Yore read, and the SHA-256 of every file in the zip.
• captures/: the bytes of the first capture of each version, as the archive stores them, each file named by its SHA-256. Where the site sent the page compressed, the archive stored it compressed, and so does the export: the manifest states the file's encoding, and gzip -dc reads a gzip one.
• texts/: the two texts Yore derived from those bytes, the whole page and its content, each named by its SHA-256.
• assets/: the images of the versions, each named by its SHA-256.
• README.txt: what is in the zip and how to check it.

The files are stored in the zip without compression, so any tool can hash one straight out of it.

The manifest

For every page the manifest states:

• its address, its language, and how Yore learned of it;
• its removal, if the archive shows one: the kind, since when, and whether it's confirmed;
• its coverage: the number of captures, the first and the last, the captures per year, and the longest gap between two captures in days;
• every capture in the window, whatever its status: the time in UTC, the address captured, the address in the web archive, the status, the type and the archive's digest;
• every version: its first and last capture, how many captures show it, the SHA-256 of its bytes and of its two texts, and its images, each with the date of its own capture and how many days that is from the page's.

For every file it states the path, the SHA-256 and the size in bytes. A capture's entry adds its encoding where it has one, the archive's digest, whether the bytes match that digest, the address they were fetched from and when. An image's entry adds its encoding, the archive's digest and whether the bytes match it. A text's entry has the three alone: it is Yore's derivation, and the archive holds no digest of it.

The SHA-256 of manifest.json itself names the export. It's what the Export tab lists and what the verify page recognises.

Check it by hand

Every file is named by its own hash, so the check is one command on any machine:

unzip export.zip -d export
cd export
shasum -a 256 captures/* assets/*

Each line must print a hash equal to the file's name. A text is named the same way, with .txt after the hash.

To check a capture against the archive itself, take its snapshot_url from the manifest and put id_ after the timestamp. That address answers the raw bytes:

curl -sL -H 'Accept-Encoding: gzip' https://web.archive.org/web/20190102084842id_/https://www.tesla.com/model3 | shasum -a 256

Check it with the command

yore verify export.zip

The yore command hashes every file, compares it with the manifest, and recomputes the archive's digest of every capture. It works offline and needs no account. It exits with 6 if anything in the export doesn't verify.

What it does not hold

An export carries no timestamp from a third party and no signature. It proves that its files are what the manifest names, and each capture can be checked against the archive. It doesn't prove on its own when the export was made: the verify page states when Yore issued it.